Splunk Search

Can I run a query on my results from a previous query?

koocies
Path Finder

or do I have to run a whole new query?

0 Karma

memarshall63
Communicator

Not much to go on here... Maybe you can provide some more details around what you've tried and what your current data set or query attempts are...

Broadly you can look at these:

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Search
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Where
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch

0 Karma

koocies
Path Finder

If I run a query I get results, then I look over my results. Sometimes I want to filter out certain things from my results. I'd rather filter out my results and to research the index. I don't need to go back to well, I've got what I need, but I just need to filter out a little.

0 Karma

memarshall63
Communicator

You're looking for a way to persist some search results -- and then further filter them?

There's a few mechanisms for that with Splunk.
I think one is the closest to what you're looking for:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob
See also:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing

There's likely a few others that also would help.
Good luck.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...